CVE-2026-74609 Overview
CVE-2026-74609 is a use-after-free vulnerability in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem. The flaw resides in tipc_node_link_down() in net/tipc/node.c, which caches the le->link pointer before acquiring the node lock. A concurrent teardown path can free the cached link object while another CPU still references it, producing a use-after-free read in tipc_link_is_establishing() and a use-after-free write in tipc_link_reset(). The issue was confirmed via KASAN on kernel 7.2.0-rc5-00284-gaf39eb111ce6.
Critical Impact
Local attackers with permissions to manage TIPC bearers can trigger memory corruption in kernel space, enabling privilege escalation, denial of service, or arbitrary code execution in the kernel context.
Affected Products
- Linux kernel builds containing the TIPC subsystem with the unlocked le->link read pattern
- Distributions shipping vulnerable kernels prior to the fix commits listed in the kernel.org stable tree
- Systems using UDP-bearer TIPC configurations where disable_media() defers cleanup asynchronously
Discovery Timeline
- 2026-08-22 - CVE-2026-74609 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74609
Vulnerability Analysis
The vulnerability is a race condition producing a use-after-free in the TIPC link management code. tipc_node_link_down() reads struct tipc_link *l = le->link; before taking n->lock, then later dereferences l under the lock. A parallel caller invoking the same function with delete=true frees l with plain kfree() while holding n->lock. Because the first caller cached the pointer outside the lock, the lock does not serialize the read against the free. The cached pointer becomes dangling once the delete path completes.
Root Cause
The root cause is improper synchronization between readers and the destroyer of the link object. The link is freed with kfree() rather than kfree_rcu(), and UDP-bearer cleanup only schedules asynchronous cleanup_bearer() work. The synchronize_net() call therefore runs after links are already released. Any in-flight caller that read le->link before the lock was taken will dereference freed slab memory. The fix moves the le->link read inside tipc_node_write_lock(n) so that a racing teardown either has not yet executed, or the reader observes NULL.
Attack Vector
Exploitation requires local access and the capability to manipulate TIPC bearers, typically via the netlink command TIPC_NL_BEARER_DISABLE, which flows through bearer_disable() → tipc_node_delete_links() → tipc_node_link_down(n, bearer_id, true). A second execution context, such as tipc_rcv() handling a TIPC_LINK_DOWN_EVT or the link supervision timer via tipc_node_timeout(), must be concurrently traversing tipc_node_link_down(). Winning the race yields a slab use-after-free, which an attacker can groom into kernel memory corruption. The vulnerability is triggered only when TIPC is loaded and configured.
See the upstream patches for technical details: Kernel Change 2be741a, Kernel Change 47ba708, and Kernel Change c3f2347.
Detection Methods for CVE-2026-74609
Indicators of Compromise
- KASAN slab-use-after-free reports referencing tipc_link_is_establishing or tipc_node_link_down in the call stack
- Unexpected kernel oopses or panics originating from net/tipc/node.c or net/tipc/link.c
- Unauthorized invocations of netlink TIPC_NL_BEARER_DISABLE from non-administrative processes
Detection Strategies
- Enable KASAN on test kernels to surface use-after-free conditions in the TIPC path
- Audit loaded kernel modules for the tipc module on systems that do not require it
- Monitor auditd for netlink socket operations targeting the TIPC family and correlate with bearer configuration changes
Monitoring Recommendations
- Alert on kernel ring buffer entries containing BUG: KASAN, general protection fault, or Oops referencing TIPC symbols
- Track process capabilities that include CAP_NET_ADMIN, which is required to disable bearers
- Collect and centralize dmesg and /var/log/kern.log output for retrospective forensic analysis
How to Mitigate CVE-2026-74609
Immediate Actions Required
- Apply the upstream kernel patches that move the le->link read inside tipc_node_write_lock(n)
- Unload the tipc kernel module on systems that do not require inter-process cluster communication
- Restrict CAP_NET_ADMIN to a minimal set of trusted administrative accounts
Patch Information
The fix is available in the Linux stable tree across multiple branches. Relevant commits include 2be741a, 47ba708, 5558a83, 69d2094, a714d62, c3f2347, cba9ccb, and de017c2. Rebuild and redeploy affected kernels, or install vendor-supplied updates that incorporate these commits.
Workarounds
- Blacklist the tipc module by adding blacklist tipc to /etc/modprobe.d/ and rebuilding the initramfs
- Prevent unprivileged loading of TIPC via sysctl kernel.modules_disabled=1 after boot on hardened hosts
- Enforce SELinux or AppArmor policies that deny netlink TIPC operations to non-administrative processes
# Configuration example
# Disable and blacklist the TIPC module
sudo modprobe -r tipc
echo 'blacklist tipc' | sudo tee /etc/modprobe.d/blacklist-tipc.conf
echo 'install tipc /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-tipc.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
